CJEU Lowers Threshold For GDPR Damages

Last Thursday the Court of Justice of the European Union ("CJEU") issued a long awaited ruling on damages resulting from a data protection infringement (C-300/21). Since the Regulation (EU) 2016/679 (General Data Protection Regulation; "GDPR") came into force on 25 May 2018, claims for damages under Art 82 GDPR due to alleged data protection violations like unlawful data processing or incompliance with the GDPR as well as in the context of data breaches or leaks have been steadily increasing. The CJEU's recent ruling clarifies essential issues but raises just as many questions.

The CJEU decision relates to a dispute before the Austrian Regional Court for Civil Law Matters Vienna (Landesgericht für Zivilrechtssachen Wien), where the claimant (data subject as per the GDPR's definition) requested EUR 1,000 damages as compensation. The claimant allegedly suffered harm, because the defendant generated upon statistical extrapolation a prognosis of the claimant's